Re: [perl #42594] [PATCH] Probable buffer overflow in compilers/imcc/parser_util.c

2007-04-18 Thread Leopold Toetsch
Am Dienstag, 17. April 2007 23:48 schrieb Steve Peters: > +        strncpy(format, fmt, sizeof(format - 1)); Me thinks, that it's better to check the len of the format as it grows, considering the amount what would be strcat'ed. If an index really would overflow format, a proper syntax error cou

Re: [perl #42594] [PATCH] Probable buffer overflow in compilers/imcc/parser_util.c

2007-04-18 Thread Steve Peters
On Wed, Apr 18, 2007 at 11:18:20AM +0200, Mehmet Yavuz Selim Soyturk wrote: > >+format[sizeof(format - 1)] = '\0'; > > > Shouldn't that be 'format[sizeof(format) - 1]' ? > Yes, thanks! Good catch! Steve

Re: [perl #42594] [PATCH] Probable buffer overflow in compilers/imcc/parser_util.c

2007-04-18 Thread Mehmet Yavuz Selim Soyturk
+format[sizeof(format - 1)] = '\0'; Shouldn't that be 'format[sizeof(format) - 1]' ? -- Mehmet

Re: [perl #42594] [PATCH] Probable buffer overflow in compilers/imcc/parser_util.c

2007-04-17 Thread chromatic
On Tuesday 17 April 2007 14:48, Steve Peters wrote: > I don't know how easily this is reached, but since the "fmt" variable > is only NULL checked, it seems like this would be possible to reached. Hm, this patch breaks some tests for me: t/compilers/imcc/imcpasm/optc.t1 256431 8 t